Fix url

docker-compose.yml

@@ -25,7 +25,7 @@ services:
     restart: unless-stopped
     environment:
       PORT: ${ATTIVITA_BACKEND_PORT}
-      CORS_ORIGIN: http://localhost:${ATTIVITA_FRONTEND_PORT}
+      CORS_ORIGIN: ${ATTIVITA_FE_PUBLIC_URL}
       DATABASE_URL: postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@db:5432/scouthub?schema=public
       KEYCLOAK_BASE_URL: http://keycloak:8080
       KEYCLOAK_REALM: scouthub
@@ -41,8 +41,8 @@ services:
     build:
       context: ./scouthub-attivita-fe
       args:
-        API_URL: http://localhost:${ATTIVITA_BACKEND_PORT}
-        KEYCLOAK_BASE_URL: http://localhost:${KEYCLOAK_PORT}
+        API_URL: ${ATTIVITA_BE_PUBLIC_URL}
+        KEYCLOAK_BASE_URL: ${KEYCLOAK_PUBLIC_URL}
     restart: unless-stopped
     ports:
       - "${ATTIVITA_FRONTEND_PORT}:80"
@@ -56,7 +56,7 @@ services:
     environment:
       PORT: ${HOME_BACKEND_PORT}
       DATABASE_URL: postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB}?schema=public
-      FRONTEND_BASE_URL: http://localhost:${HOME_FRONTEND_PORT}
+      FRONTEND_BASE_URL: ${HOME_FE_PUBLIC_URL}
       # Rete interna Docker: la validazione del JWT (JWKS) non controlla l'issuer,
       # quindi non serve che coincida con l'hostname visto dal browser (localhost:8081).
       KEYCLOAK_BASE_URL: http://keycloak:8080
@@ -75,11 +75,11 @@ services:
     build:
       context: ./scouthub-home-fe
       args:
-        KEYCLOAK_BASE_URL: http://localhost:${KEYCLOAK_PORT}
-        ORG_SERVICE_API_BASE_URL: http://localhost:${HOME_BACKEND_PORT}
-        ATTIVITA_FE_BASE_URL: http://localhost:${ATTIVITA_FRONTEND_PORT}
-        MAGAZZINO_FE_BASE_URL: http://localhost:${MAGAZZINO_FRONTEND_PORT}
-        EVENTI_FE_BASE_URL: http://localhost:${EVENTI_FRONTEND_PORT}
+        KEYCLOAK_BASE_URL: ${KEYCLOAK_PUBLIC_URL}
+        ORG_SERVICE_API_BASE_URL: ${HOME_BE_PUBLIC_URL}
+        ATTIVITA_FE_BASE_URL: ${ATTIVITA_FE_PUBLIC_URL}
+        MAGAZZINO_FE_BASE_URL: ${MAGAZZINO_FE_PUBLIC_URL}
+        EVENTI_FE_BASE_URL: ${EVENTI_FE_PUBLIC_URL}
     restart: unless-stopped
     ports:
       - "${HOME_FRONTEND_PORT}:80"
@@ -109,8 +109,8 @@ services:
     build:
       context: ./scouthub-magazzino-fe
       args:
-        KEYCLOAK_BASE_URL: http://localhost:${KEYCLOAK_PORT}
-        MAGAZZINO_API_BASE_URL: http://localhost:${MAGAZZINO_BACKEND_PORT}
+        KEYCLOAK_BASE_URL: ${KEYCLOAK_PUBLIC_URL}
+        MAGAZZINO_API_BASE_URL: ${MAGAZZINO_BE_PUBLIC_URL}
     restart: unless-stopped
     ports:
       - "${MAGAZZINO_FRONTEND_PORT}:80"
@@ -141,8 +141,8 @@ services:
     build:
       context: ./scouthub-eventi-fe
       args:
-        KEYCLOAK_BASE_URL: http://localhost:${KEYCLOAK_PORT}
-        EVENTI_API_BASE_URL: http://localhost:${EVENTI_BACKEND_PORT}
+        KEYCLOAK_BASE_URL: ${KEYCLOAK_PUBLIC_URL}
+        EVENTI_API_BASE_URL: ${EVENTI_BE_PUBLIC_URL}
     restart: unless-stopped
     ports:
       - "${EVENTI_FRONTEND_PORT}:80"
@@ -159,13 +159,27 @@ services:
     volumes:
       - scouthub_keycloak_db_data:/var/lib/postgresql/data
 
+  keycloak-realm-render:
+    image: alpine:3.20
+    restart: "no"
+    entrypoint: ["sh", "/render-realm-template.sh"]
+    environment:
+      HOME_FE_URL: ${HOME_FE_PUBLIC_URL}
+      ATTIVITA_FE_URL: ${ATTIVITA_FE_PUBLIC_URL}
+      MAGAZZINO_FE_URL: ${MAGAZZINO_FE_PUBLIC_URL}
+      EVENTI_FE_URL: ${EVENTI_FE_PUBLIC_URL}
+    volumes:
+      - ./keycloak/realm-export.template.json:/template/realm-export.template.json:ro
+      - ./keycloak/render-realm-template.sh:/render-realm-template.sh:ro
+      - scouthub_keycloak_realm:/rendered
+
   keycloak:
     image: quay.io/keycloak/keycloak:26.7
     restart: unless-stopped
-    # --import-realm importa keycloak/realm-export.json solo se il realm non esiste già.
-    # Le correzioni post-import (ruoli service account, protocol mapper "organization") non
-    # coperte dal file JSON sono automatizzate dal servizio one-shot "keycloak-init" sotto,
-    # non più manuali (vedi CLAUDE.md).
+    # --import-realm importa il realm-export.json generato da keycloak-realm-render (a partire
+    # dal template) solo se il realm non esiste già. Le correzioni post-import (ruoli service
+    # account, protocol mapper "organization") non coperte dal file JSON sono automatizzate dal
+    # servizio one-shot "keycloak-init" sotto, non più manuali (vedi CLAUDE.md).
     command: start-dev --import-realm --health-enabled=true
     environment:
       KC_DB: postgres
@@ -178,16 +192,23 @@ services:
       # Verificare con `kc.sh show-config` che i flag richiesti siano invariati nella versione
       # effettivamente usata: i nomi dei feature flag cambiano tra minor version di Keycloak.
       KC_FEATURES: organization,admin-fine-grained-authz:v1
-      KC_HOSTNAME: localhost
-      KC_HOSTNAME_PORT: "${KEYCLOAK_PORT}"
+      # KC_HOSTNAME come URL completo (schema+host, es. https://auth.tuodominio.it dietro Caddy
+      # in produzione, http://localhost:6999 in locale): Keycloak lo usa per generare tutti i link
+      # (redirect, well-known, ecc.) visti dal browser. KC_PROXY_HEADERS è necessario perché
+      # Keycloak sta dietro un reverse proxy (Caddy) che termina il TLS e inoltra in http.
+      KC_HOSTNAME: ${KEYCLOAK_PUBLIC_URL}
       KC_HTTP_ENABLED: "true"
+      KC_PROXY_HEADERS: xforwarded
     ports:
       - "${KEYCLOAK_PORT}:8080"
     volumes:
-      - ./keycloak/realm-export.json:/opt/keycloak/data/import/realm-export.json:ro
+      - scouthub_keycloak_realm:/opt/keycloak/data/import:ro
       - ./keycloak/themes/scouthub:/opt/keycloak/themes/scouthub:ro
     depends_on:
-      - keycloak-db
+      keycloak-db:
+        condition: service_started
+      keycloak-realm-render:
+        condition: service_completed_successfully
     healthcheck:
       test: ["CMD-SHELL", "exec 3<>/dev/tcp/127.0.0.1/9000 && echo -e 'GET /health/ready HTTP/1.1\\r\\nHost: localhost\\r\\nConnection: close\\r\\n\\r\\n' >&3 && grep -q '\"status\": \"UP\"' <&3"]
       interval: 5s
@@ -211,3 +232,4 @@ services:
 volumes:
   scouthub_db_data:
   scouthub_keycloak_db_data:
+  scouthub_keycloak_realm: